Skip to content

/foo: path is too broad... #2014

Open
Open

Description

@kobaz

Version

codebase-memory-mcp 0.10.8

Platform

Linux (x64)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

ui

What happened, and what did you expect?

Our projects live in for example a path called /platform

And then we have /platform/System (git repo)
/platform/Modules/Core (git repo)
/platform/Modules/Web (git repo)

codebase-memory-mcp refuses to index this as one project (saying path too broad)

My workaround is setting up a separate path containing hard links to everything and then indexing THAT, which is cumbersome and really unworkable at scale.

It looks like there's a hard coded check where if the path element is a single crumb like 'platform' versus like /opt/platform, it will outright reject this. And it looks like there's no way to override this via options or env variables.

Reproduction

create /platform/System
create /platform/Modules/Core
create /platform/Modules/Web

index_repository /platform

Logs


Diagnostics trajectory (memory / performance / leak issues)


Project scale (if relevant)

No response

Confirmations

  • I searched existing issues and this is not a duplicate.
  • My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.

Activity

  1. added
    bugSomething isn't working
    on Sep 2, 2026
  2. added
    enhancementNew feature or request
    securitySecurity vulnerabilities, hardening
    priority/normalStandard review queue; useful PR with ordinary maintainer urgency.
    and removed
    bugSomething isn't working
    windowsWindows-specific issues
    on Sep 3, 2026
  3. DeusData commented on Sep 3, 2026

    @DeusData
    Owner

    Thank you for the concrete layout and workaround.

    Current main intentionally classifies a one-component POSIX path such as /platform as CBM_WS_DENY_TOO_SHALLOW, and it currently makes that verdict non-overridable. That means this is a real capability gap, but the existing behavior is a security guard rather than a Windows-specific parser bug. I have corrected the labels accordingly.

    PR #2017 is the active implementation proposal. Because it introduces an override for a workspace safety refusal, we need more time to review the policy boundary before accepting a public mechanism. Please do not treat that PR as pre-approved yet. Thank you for raising the legitimate sibling-repository use case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestpriority/normalStandard review queue; useful PR with ordinary maintainer urgency.securitySecurity vulnerabilities, hardeningux/behaviorDisplay bugs, docs, adoption UX

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions